Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,142 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,472
1,061
1,026
908
Platforms
39,776
7,142
6,518
3,852
3,601
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,230
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
MINIRAT C2Beacon
YARA
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
IoT botnet malware family used for DDoS and proxy infrastructure
Photo-themed ZIP phishing campaign dropping a Node.js implant
IoT botnet malware family used for DDoS and proxy infrastructure
Cloud extortion group exploiting exposed credentials and storage
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Fraud framework powering scam domains for crypto and gambling schemes
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Detects commands exporting all environment variables (env, set, printenv) to a file, often used to steal CI/CD secrets on developer workstations. The rule specifically looks for these commands being executed by common scripting/execution environments like node.exe, python.exe, bash, or cmd.exe.
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
Detects unusual internal SSH connections between private IP addresses that are not initiated by common, trusted administrative tools (like ssh.exe, putty.exe, etc.). The rule aggregates these connections by source and host to identify potential lateral movement.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
Page 220 of 341